v0.2.2

Repository and packaging changes. The decision core and the three entry points
behave exactly as 0.2.1 left them; what changes is the licence, what each package
ships, and how much of it a gate checks.

Changed

• The licence is Apache-2.0, not MIT. LICENSE is now the standard Apache
  License 2.0 text, carried without a copyright line because the licence puts the
  copyright statement in NOTICE, where it now is; all four manifests say
  Apache-2.0, as do the five READMEs. A release is the only thing that can make
  this visible — published metadata is immutable, so 0.2.1 and every version before
  it still report MIT on npm.

• Every package ships five READMEs. The four translations were listed in
  files[] from the start while the package directories held none, so npm dropped
  them without a word and every published tarball carried the English page alone.
  Each package now carries its own set: a package's npm page is its own document,
  so the repository's translations could not stand in for it.

• jevcore-dsh follows the plugin conventions of the harness it plugs into.
  dsh.manifestVersion: 1; engines.dsh and the @deepseek-ai/dsh-tools peer
  range gained the >=0.1.6-0 <0.2.0 segment, so one pin covers the current alpha
  line as well as the two earlier ones; engines.node is the harness's
  ^22.19.0 || >=24.0.0 rather than >=20.

• files[] ships src and CHANGELOG.md, matching the sibling plugins, so a
  stack trace from a published package points at readable source.

• Releases authenticate with OIDC trusted publishing instead of a stored
  token. publish.yml becomes release.yml — the filename npm's trusted
  publisher matches exactly, extension included, and the name 38 of the sibling
  plugin repositories use. The workflow holds no credential, takes
  id-token: write, and publishes with provenance. Hand-publishing is no longer
  a fallback: with 2FA on the account it prints ✅ Published and exits 0 while
  only staging the version for approval, and the staged version then occupies
  that version number while being invisible to npm stage list — which is how
  0.2.2 was consumed without ever reaching the registry.

Added

• scripts/check-readme-sync.mjs, run by check and by prepublishOnly. It
  treats each five-language README set as a unit: same ## sections, same fenced
  code blocks compared byte for byte, same links, same configuration keys, same
  licence, and the same ordered structural shape — headings, table rows, code
  blocks, rules and list items — with prose excluded, because prose is what a
  translation is for. The shape is what catches a section dropped and another
  duplicated in its place, which a section count alone cannot see.

• scripts/sync-legal-files.mjs also ships CHANGELOG.md to each package, and
  .gitattributes pins LF for every text file, so the byte comparison above cannot
  fail for a line-ending reason.

• Three CI workflows, taken from the sibling plugin repositories: compat.yml
  (pack, install and import all three entry points, then mount the plugin row in a
  scratch profile), plugin-doctor.yml (the static plugin gate) and
  scorecard.yml (OpenSSF Scorecard).

Fixed

• NOTICE named a dependency that no longer exists, a script that was deleted,
  and the wrong licence. It listed @openrouter/sdk as an optional dependency of
  two packages and offered packages/core/scripts/check-openrouter-schemas.mjs as
  a verification script; both were gone by 0.2.0, and the file still said MIT.
  Rewritten against what the manifests and the tree actually contain.